Groq is building hardware-rooted security foundations to protect sensitive AI workloads across hardware and software boundaries. This Sr. Staff Platform Security Engineer role owns security architecture spanning firmware security, hardware trust, attestation, trusted execution environments, and protected workload execution, with a focus on establishing and maintaining trust end to end.
Location: Dallas-Fort Worth, TX (hybrid). This role is based in one of Groq’s hiring hubs: Dallas, San Francisco, or New York City. Flexibility to work remotely may be available while a local Groq office is established, with an expectation that the role transitions onsite once the office opens.
Compensation: $341,400 to $401,600 per year (United States only). Groq’s Total Cash philosophy incorporates potential bonus value directly into base pay. Beyond cash compensation, Groq offers a Long-Term Incentive (LTI) Program and a robust suite of employee benefits.
What you’ll do
- Set technical direction and own security architecture across hardware, firmware, systems software, and protected workload execution.
- Design and build architectures for hardware-rooted trust, attestation, trusted execution environments (TEEs), and hardware-backed isolation.
- Architect attestation capabilities that establish and verify trust across hardware, firmware, host, and workload boundaries.
- Partner with hardware, firmware, and systems engineers to shape platform integrity, including secure or measured boot, device identity, and other hardware-rooted security capabilities.
- Design security capabilities that enable protected workload execution while maintaining trust through the workload lifecycle.
- Develop secure approaches for cryptographic key material, credentials, identity, certificates, and provisioning within trusted computing environments.
- Shape trusted compute infrastructure lifecycle security, from provisioning and platform initialization through operation and decommissioning.
- Lead threat modeling and security analysis across hardware, firmware, host software, and workload execution, identifying systemic risks and driving durable mitigations.
- Develop systems software, security tooling, and automation to make hardware-backed security capabilities reliable and operable at scale.
- Lead security-sensitive designs across organizational boundaries, translating hardware and systems risks into practical engineering decisions.
- Establish technical patterns and influence security direction across hardware, firmware, systems, platform, and security engineering.
- Partner across engineering and security to strengthen customer trust, platform reliability, and support compliance requirements.
- Communicate trust models, security architecture, technical tradeoffs, and risk clearly to engineers, technical leaders, and security leadership.
What you bring
- 6+ years of systems, firmware, hardware, or security engineering experience, with deep expertise in low-level systems security and experience with hardware-rooted trust, attestation, TEEs, confidential computing, or related technologies.
- Proven ability setting technical direction and owning complex security architecture spanning multiple layers of the hardware and software stack.
- Deep expertise in firmware security, hardware-rooted trust, attestation, TEEs, protected workload execution, or closely related low-level security domains.
- Strong understanding of hardware-rooted trust, including roots of trust, platform integrity, secure or measured boot, device identity, and hardware-backed attestation.
- Experience designing or implementing attestation systems and reasoning about trust across hardware, firmware, host, and workload boundaries.
- Strong understanding of firmware and low-level systems security, including boot chains, platform integrity, and security boundaries between hardware and software.
- Strong understanding of cryptographic systems, key management, certificate lifecycle, secure credential management, and secure provisioning in trusted computing environments.
- Systems engineering skills developing low-level systems software, security tooling, firmware, or production automation in C, C++, Rust, Go, Python, or similar languages.
- Ability to threat model complex systems and reason about attacks spanning hardware, firmware, operating systems, infrastructure, and application workloads.
- Experience leading ambiguous, cross-functional technical initiatives and influencing engineering direction across specialized disciplines.
- Ability to communicate complex trust models, security architecture, and technical risk to different audiences.
- Experience developing or securing firmware, platform initialization, device security, or hardware-backed security mechanisms is valuable.
- Experience integrating hardware-rooted trust, attestation, or confidential computing with higher-level infrastructure, identity, key-management, or workload systems is valuable.
- Experience with bare-metal lifecycle security or securing large-scale compute environments is valuable.
Technologies: C, C++, Rust, Go, Python; firmware security; hardware-rooted trust; attestation; trusted execution environments (TEEs); protected workload execution; confidential computing; cryptographic key material; certificates; secure or measured boot.
Export control notice (US posting): This position may require access to technology and/or information subject to U.S. export control laws and regulations, including the Export Administration Regulations (EAR). Candidates must qualify as U.S. Persons for export control purposes (U.S. citizen, U.S. lawful permanent resident (Green Card holder), or a protected individual under 8 U.S.C. § 1324b(a)(3), such as a refugee or asylee), or otherwise be eligible for an applicable export license.
Export control notice (Non-US postings): This position may require access to technology and/or information subject to U.S. export control laws and regulations, as well as applicable local laws and regulations, including the Export Administration Regulations (EAR). Candidates must meet all relevant export control eligibility criteria.
